Tuesday, 19 May 2015

various fake vat tax emails

Various fake vat tax emails are with a zip attachment...

These emails aren't from these companies at all , they are just being used to make the email look more genuine, ie. from a real company.
Note
It's also worth remembering that the company itself  may not have any knowledge of this email and it's link(s) or attachment as it won't have come from their servers and IT systems but from an external bot net.

It's not advised to ring them as there won't really be anything they can do to help you.

Headers:
Subject: adjustment alert
Subject: adjustment notification
Subject: adjustment report
Subject: change guidance
Subject: change notice
Subject: Custom adjustment guidance
Subject: Custom adjustment notice
Subject: Custom change notice
Subject: Custom change report
Subject: Custom increase guidance
Subject: Custom increase reminder
Subject: Custom increase report
Subject: Duties adjustment guidance
Subject: Duties adjustment notification
Subject: Duties change notice
Subject: Duties change notification
Subject: Duties change reminder
Subject: Duties change reminder 
Subject: Duties change report
Subject: Duties increase guidance
Subject: Duties increase notice
Subject: Duties increase notification
Subject: Duties increase report
Subject: increase alert
Subject: increase report
Subject: Levy adjustment alert
Subject: Levy adjustment guidance
Subject: Levy adjustment notice
Subject: Levy adjustment report
Subject: Levy change alert
Subject: Levy change guidance
Subject: Levy change notice
Subject: Levy increase alert
Subject: Levy increase guidance
Subject: Levy increase notice
Subject: Levy increase reminder
Subject: Tax adjustment guidance
Subject: Tax adjustment report
Subject: Tax change alert
Subject: Tax change reminder
Subject: Tax change report
Subject: Tax increase notification
Subject: Tax increase report
Subject: Toll adjustment alert
Subject: Toll adjustment notice
Subject: Toll change alert
Subject: Toll change notification
Subject: Toll increase reminder
Message Body:
Please be informed that VAT decreases before Monday.
Observe the document attached.
Do not forget that money to be settled to the government will be reevaluated.

Anna Adams
Senior Consultant
--
Be noted that VAT increases on Thursday.
View the document enclosed.
Note that fees to be settled to the state are going to be reestimated.

Diane Smith
Tax authority
--
Be warned that VAT alters from Monday.
See the document attached.
Remeber that tax amounts to be paid to the treasury are going to be reevaluated.

Jessica Jones
Chief accountant
--
Be noted that VAT doubles before Friday.
See the document attached.
Remeber that tax amounts to be paid to the government are going to be reestimated.

Jessica Adams
Tax Consultant
--
Please be informed that VAT increases before Thursday.
View the act enclosed.
Do not forget that money to be settled to the treasury are going to be reevaluated.

Jessica Lewis
Tax authority
--
Please be informed that VAT alters from Tuesday.
View the document below.
Remeber that sums to be settled to the tax authorities have to be reevaluated.

Sarah Jones
Tax Consultant
--
We inform you that VAT rises from Thursday.
See the act attached.
Note that money to be settled to the tax authorities are going to be reevaluated.

Susan Smith
Senior Consultant


Attached to the message is a Zip file:
Doc#433806.zip
Inside the Zip file is a Windows Executable file:
 fax2_info.exe

Sha256 Hashes:
0dada1e40d90c28f50b5fcba3ca39ddccb650be4e5cee3e12f49544eb6fc92b2 [1]
Malware Virus Scanner Reports:
VirusTotal Report: [1] (detection 4/57)
Malwr Report: [1]
Hybrid Analysis Report: [1]
Cheers,
Steve

1 comment:

Anonymous said...

So how do you get rid of it?